11 minutes reading
Contact form phishing is an attack in which criminals submit a public web form using an attacker-controlled address and a crafted message, so the organization’s own automated reply carries the lure to thousands of targets. The email is genuinely sent by the victim organization, passes every authentication check, and usually contains a phone number rather than a link.
What Contact Form Phishing Is and Why It Works
Contact form phishing turns a normal business courtesy into a delivery channel. Most organizations run a Contact Us, Request a Callback, or Book an Appointment form that sends an automatic acknowledgement containing the details the visitor typed. An attacker completes that form with a display name, a phone number, and message text chosen to impersonate a trusted brand, then arranges for the acknowledgement to reach a large recipient list rather than a single inbox.
The attack works because every trust signal in the resulting email is real. The sending domain belongs to a legitimate organization. The mail server is that organization’s own. The message is not a forgery of a brand, it is an authentic email from a company that genuinely operates the form. Recipients who have been trained to check the sender domain find nothing wrong, because nothing about the sender is wrong.
Two properties make this different from ordinary brand impersonation. The attacker needs no compromised account and no lookalike domain, so the usual preparation signals that precede an impersonation campaign are absent. And the abused organization is not the target, which means it often learns nothing until recipients start calling its switchboard. Background on the conventional version of this problem is covered in email spoofing and lookalike domains.
How the Attack Uses Your Own Autoresponder
The mechanics are simple enough to be reproduced by an attacker with no technical skill beyond reading documentation, which is why the technique spread quickly once it appeared.
| Stage | What the attacker does | Why it matters |
|---|---|---|
| 1 | Registers a free tenant on a major cloud provider, choosing a display name that impersonates a known brand | Supplies a sender identity and a contact block with no cost and no verification |
| 2 | Adds a phone number and pretext text to the profile and message fields | The phone number is the payload, not an incidental detail |
| 3 | Creates a mail flow rule that auto-forwards anything arriving at that tenant to a distribution list | Converts a one-to-one acknowledgement into a one-to-many broadcast |
| 4 | Submits the target company’s public web form using that address | The company’s systems now generate the message |
| 5 | The company’s autoresponder fires, echoing the attacker’s name, number, and text | A fully authenticated email leaves a trusted domain |
| 6 | The forwarding rule fans the message out to thousands of recipients | The victim company’s reputation carries the campaign |
Step 5 is the pivot. The organization is not spoofed, breached, or impersonated. Its own system, working exactly as designed, produces the phishing email. Reported targeting has concentrated on sectors whose forms invite personal follow-up, including legal, banking, healthcare, and insurance, where a request for a callback is an ordinary thing for a stranger to submit.
Why Email Authentication Does Not Stop Contact Form Phishing
SPF, DKIM, and DMARC verify that a message genuinely came from the domain it claims. In a contact form attack, it did. The autoresponder is sent by the organization’s real mail infrastructure from its real domain, so it is signed correctly, aligns correctly, and passes DMARC at enforcement. Authentication is working. It is simply answering a question the attack does not ask.
This is worth stating plainly because email authentication is often sold as the answer to impersonation, and for spoofing and lookalike-domain attacks it genuinely is. The distinction is between forged provenance and abused provenance. A forged message claims to be from you. A contact form attack is from you. No DMARC policy can reject a message the domain owner legitimately sent, and setting one to p=reject changes nothing about this technique. How the protocols divide that work is set out in SPF, DKIM, and DMARC compared.
Authentication still earns its place here, in a different role. DMARC aggregate reporting shows what the domain sends and at what volume, which is how an autoresponder emitting thousands of messages in an afternoon becomes visible as an anomaly rather than as a mystery. Threatcop’s TDMARC surfaces that sending picture along with lookalike domain activity, so a team can see the spike and the imitation attempts in the same place instead of reconstructing both from a support ticket. Reputation consequences of an unnoticed spike are covered in domain reputation and deliverability.
Why Content Filters Miss the Callback Payload
The email contains no malicious link and no attachment. The action it requests is a phone call, which is why gateway controls built to detonate URLs and sandbox files return a clean verdict. MITRE ATT&CK classifies this pattern as T1566.004, Spearphishing Voice, describing callback phishing as a variant in which a message directs the recipient to call a number the adversary controls.
The technique is also known as telephone-oriented attack delivery, and it reverses the usual initiative. In vishing, the attacker calls the target. In callback phishing, the target calls the attacker, which lowers their guard because they believe they chose to make contact. What follows on the call is the actual attack: a scripted operator requests credentials or a one-time passcode, walks the caller through installing remote access software, or processes a fake refund. Ransomware crews including Luna Moth and the groups that grew out of Conti have used the pattern as an initial access route since the BazarCall campaigns of 2020 and 2021.
Voice as an attack surface is the part most awareness programs under-train, and it is getting harder as synthetic speech improves, a shift described in AI voice cloning in vishing attacks and in this guide to how a vishing attack unfolds.
What Callback Fraud Costs, in Reported Numbers
The FBI’s 2025 Internet Crime Report logged 1,008,597 complaints, the first time the Internet Crime Complaint Center has passed one million in a year, against 859,532 in 2024. Reported losses reached $20,877,000,000, a 26% rise.
Two categories in that report map directly onto callback phishing outcomes. Business email compromise accounted for $3,046,598,558 across 24,768 complaints, an average near $123,000 per incident. Tech support fraud, the pretext most callback operators run, accounted for $2,134,675,818. Phishing and spoofing produced far more complaints, 191,561, against $215,843,126 in losses, which shows the shape of the economics: volume attacks generate reports, while the attacks that put a human on a phone generate money.
The organization whose form was abused rarely appears in any of those figures, and that is the part worth noticing. Its loss is reputational and operational: a domain reputation hit, a support queue full of strangers asking about a charge, and customers who now associate the brand with a scam. Loss patterns for the related family of attacks are collected in business email compromise.
How to Harden a Web Form So It Cannot Be Weaponized
Most published guidance on this attack addresses the recipient. The organization hosting the form has the more decisive controls, because the attack does not function if the autoresponder stops being useful to an attacker. Work through the following.
- Stop echoing user-supplied content. An acknowledgement that repeats the visitor’s name, message, and phone number is what carries the lure. Confirm receipt without quoting the submission.
- Send acknowledgements only to verified addresses. A double opt-in or a confirmation link before the full reply breaks the forwarding chain the attack depends on.
- Rate limit per address, per IP, and per form. Campaigns require repeated submissions; a few per hour is generous for a genuine enquiry.
- Apply a CAPTCHA or equivalent bot control, accepting that it reduces volume rather than eliminating it, since these submissions are often manual.
- Strip or neutralize contact details in free-text fields. Phone numbers and URLs in a message body have no reason to be reproduced in an automated reply.
- Block free cloud-tenant and disposable domains at submission where business rules allow it.
- Cap automated sending volume per hour, with an alert when the cap is approached, so a campaign trips a threshold rather than running all day.
- Log every submission with source address and timestamp, so abuse can be reconstructed and reported rather than guessed at.
The first item does most of the work. An autoresponder that says a request has been received, without reproducing what was typed, cannot carry an attacker’s phone number no matter how the form is filled in. Organizations that have never audited their own forms usually find several, added over the years by marketing teams for individual campaigns, sitting outside whatever review the main contact page receives.
What to Train Recipients to Notice
Recipients cannot rely on sender checks in this attack, so training has to move to the shape of the request rather than the provenance of the message. Three signals survive.
A phone number as the only call to action is the strongest of them. Legitimate billing, security, and account notifications from established brands direct people to a portal or an app, not to a number typed into an email body. Urgency attached to a charge in the $299 to $499 range is a well-worn pattern, sized to be annoying enough to prompt a call and small enough not to prompt a call to a bank first. And a mismatch between the sender and the subject matter, an appointment confirmation from a firm the recipient has never contacted, indicates the message was manufactured rather than triggered.
The instruction that matters is procedural: never use a number supplied in an unexpected message. Look the organization up independently and call the number it publishes. That single habit defeats the entire technique regardless of how convincing the email is, and it is teachable in a way that sender inspection is not. Why impersonation keeps working despite technical controls is examined in the rise of impersonation attacks, and cloud-brand pretexts specifically in Microsoft impersonation.
How Do You Know If Your Forms Are Being Abused?
Detection usually arrives as a human signal before a technical one, which is an argument for making the human signal easy to send. Watch for a sudden rise in autoresponder volume against flat genuine enquiry numbers, inbound calls from people referencing an appointment or invoice the organization never issued, bounce and complaint rates climbing on a domain that normally sends little bulk mail, and form submissions clustered from tenant domains on a single provider.
Threatcop’s TPIR shortens the gap between the first recipient noticing and the security team acting. One-click reporting from email or WhatsApp puts the message in front of an analyst with threat-level scoring attached, and its who-else insight shows how many others received the same lure, which is the number that distinguishes a stray complaint from a campaign running on your domain. Choosing tooling for that workflow is discussed in phishing triage tools, and the cultural half in building a reporting culture that catches threats early.
Audit Your Forms This Week
Submit your own contact forms with a test address and read what comes back. If the automatic reply repeats the name, message, and phone number you entered, your domain can be used to deliver someone else’s attack today, and no email security product you own will prevent it.
Fix the autoresponder first, then give the people receiving these lures somewhere to send them. Put one-click reporting in the inbox so the first person who spots a callback number becomes an early warning for everyone else who received it.
Frequently Asked Questions
Contact form phishing is an attack in which a criminal submits an organization’s public web form using an attacker-controlled email address, display name, and phone number, so the organization’s automated acknowledgement becomes a phishing email. A mail forwarding rule on the attacker’s side fans that reply out to a large recipient list. The message is genuinely sent by the victim organization and passes all authentication checks.
No. DMARC verifies that a message really came from the domain it claims, and in this attack it did. The autoresponder is sent by the organization’s own infrastructure from its own domain, so it aligns and passes even at p=reject. DMARC remains valuable here for reporting, because aggregate data reveals an abnormal spike in sending volume, but it cannot block mail the domain owner legitimately sent.
Because links and attachments are what email security products inspect. A message containing only text and a phone number gives a gateway nothing to detonate or sandbox, so it is delivered clean. MITRE ATT&CK tracks the pattern as T1566.004, Spearphishing Voice. The attack then continues on the call, where a scripted operator requests credentials, a one-time passcode, or installation of remote access software.
Stop the autoresponder from repeating what the visitor typed, which removes the attacker’s ability to insert a phone number into your outbound mail. Add address verification before sending a full acknowledgement, rate limit submissions per address and IP, cap automated sending volume with an alert, and log submissions with source details. Audit every form on the site, not only the main contact page.
Reporting on the technique points to legal, banking, healthcare, and insurance organizations. Those sectors publish appointment and callback request forms as a matter of course, so a submission from an unknown person is routine and unlikely to be questioned. Any organization running a public form that generates an automated reply containing user-supplied text is exposed to the same abuse.
Shikha Mishra is responsible for driving the growth and adoption of TDMARC, a flagship product of Threatcop, across India, the Middle East, APAC, and the UK region. With her expertise, she helps organizations safeguard their domains so that no hacker can misuse them to send fraudulent emails, thereby protecting both their brand and reputation. She is passionate about enabling businesses to simplify the complexities of outbound email security through TDMARC’s comprehensive solution, allowing them to stay focused on what matters most to their success.
